CVE-2026-63105 in Ready eCommerce
Summary
by MITRE • 08/10/2026
ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated customers to inject malicious HTML payloads through the chat and support ticket messaging systems by exploiting unsanitized rendering via the v-html directive in Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, and SupportTicketDetails.vue. Attackers can submit crafted message content that executes arbitrary JavaScript in the browser of any shop owner or administrator who views the message, enabling session cookie theft and account takeover.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability exists within ReadyEcommerce versions prior to 4.5.2 and represents a critical stored cross-site scripting flaw that undermines the application's security posture. This weakness allows authenticated customers to inject malicious HTML payloads into the chat and support ticket messaging systems, creating a persistent threat vector that can affect administrators and shop owners who subsequently view the compromised messages. The vulnerability stems from insufficient input sanitization within the frontend components that render user-generated content, specifically exploiting the v-html directive in multiple Vue.js components including Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, and SupportTicketDetails.vue.
The technical implementation of this flaw enables attackers to submit crafted message content that bypasses standard security controls and executes arbitrary JavaScript code within the browser context of any administrator or shop owner who accesses the compromised messages. This occurs because the application directly renders user input through the v-html directive without proper sanitization, allowing malicious scripts to execute with the privileges of the victim's session. The vulnerability affects both real-time chat functionality and support ticket messaging systems, providing attackers with multiple entry points to establish persistent presence within the application environment.
The operational impact of this vulnerability extends beyond simple script execution, as it enables sophisticated attack vectors including session cookie theft, account takeover, and potential lateral movement within the compromised system. When administrators or shop owners view maliciously crafted messages, their browser sessions become vulnerable to hijacking, allowing attackers to impersonate legitimate users and gain unauthorized access to sensitive administrative functions. This represents a significant threat to business continuity and customer data protection, as the vulnerability can be exploited by malicious actors with minimal technical expertise while remaining undetected within normal application usage patterns.
Security professionals should implement immediate mitigations including input validation and output sanitization of all user-generated content before rendering in frontend components. The recommended approach involves removing or properly sanitizing the v-html directive usage in affected Vue.js components and implementing a comprehensive content security policy to prevent script execution. Organizations must also consider implementing additional layers of protection such as rate limiting for messaging systems, enhanced monitoring of administrative activity, and regular security assessments of frontend frameworks to identify similar vulnerabilities. This issue aligns with CWE-79 which addresses cross-site scripting vulnerabilities and maps to ATT&CK technique T1566 related to credential access through phishing and social engineering attacks that leverage web-based vulnerabilities for session hijacking and privilege escalation.